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PFC, U.S. Army, 
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Joint Base Myer-Henderson Hall 

Fort My er, Virginia 22211 



v. 



GOVERNMENT RESPONSE TO 
RENEWED MOTION TO DISMISS 
SPECIFICATIONS 13 AND 14 
OF CHARGE II FOR FAILURE 
TO STATE AN OFFENSE 



6 July 2012 



RELIEF SOUGHT 



COMES NOW the United States of America, by and through undersigned counsel, and 
respectfully requests this Court deny, in part, the Renewed Motion to Dismiss for Failure to State 
an Offense: Specifications 13 and 14 of Charge II. 



As the moving party, the defense has the burden of persuasion on any factual issue the 
resolution of which is necessary to decide the motion. Manual for Courts-Martial (MCM), 
United States, Rule for Courts-Martial (RCM) 905(c)(2) (2012). The burden of proof is by a 
preponderance of the evidence. RCM 905(c)(1). 



The United States stipulates to the facts set forth in paragraphs 3 and 4 of the Defense 
Motion. 

The United States stipulated to the facts contained in the facts section of the original 
Defense Motion for Failure to State an Offense. See Appellate Exhibits LXXXX and LXXXXI. 
In other words, the United States has never stipulated to the fact that the accused was entitled or 
authorized to access "each and every piece of information" the accused allegedly accessed on his 
government computer. See Def. Mot. at 2. 

Appellate Exhibit CXXXIX 

This Court ruled, inter alia, that it would adopt the narrow meaning of "exceeds 
authorized access" under the Computer Fraud and Abuse Act (CFAA) and instruct the fact finder 
that the term "exceeds authorized access" is limited to violations of restrictions on access to 
information, and not restrictions on its use. See Appellate Exhibit CXXXIX, at 9; United States 
v. Nosal 676 F.3d 854, 863-64 (9th Cir. 2012). The Court further held that it would craft 
instructions for defining "exceeding authorized access" using the language in the legislative 
history in 1996. Appellate Exhibit CXXXIX, at 9. 



BURDEN OF PERSUASION AND BURDEN OF PROOF 



FACTS 
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Wget 

"Wget" is a freely available network utility used to retrieve files from a web server using 
Hyper Text Transfer Protocol (HTTP) and File Transfer Protocol (FTP), two widely-used 
Internet protocols. See Enclosure 1 . Wget can be used as a "web crawler" by extracting 
resources linked from web pages and downloading them in sequence, repeating the process 
recursively until all the pages have been downloaded or a maximum recursive depth specified by 
the user has been reached. 1 In other words, Wget can be used to rapidly mine data from 
websites. See Enclosure 2, at 131 . During the Article 32 investigation, the United States 
presented evidence that the accused added Wget to his Secret Internet Protocol Router Network 
(SIPRNET) computer and used the program to access and harvest more than 250,000 
Department of State diplomatic cables from the Net-Centric Diplomacy (NCD) website. See 
Enclosure 3. Wget was not authorized software for Army computers. See Enclosure 2, at 126. 
In order for a person to access and obtain a diplomatic cable on the NCD website, the person has 
to individually "click" or "save" the diplomatic cable after searching for the cable or navigating 
to the cable in some manner. 



WITNESSES/EVIDENCE 

The United States requests this Court consider the previous pleadings filed by the parties 
on this issue, Enclosures 1-3, and Appellate Exhibit CXXXIX. 

LEGAL AUTHORITY AND ARGUMENT 

The defense argues, again, that the United States has failed to allege the accused 
"exceeded authorized access" within the meaning of 18 U.S.C. § 1030(a)(1) because the accused 
"was authorized to access each and every piece of information he allegedly accessed." Def. Mot. 
at 4. The defense argument has no merit. The Government's theory for Specification 13 of 
Charge II - that the accused "exceeded authorized access" in violation of 18 U.S.C. § 1030(a)(1) 
when he obtained the information at issue using an unauthorized program - is a valid application 
of the statute, even as restricted by this Court's ruling adopting the interpretation favored by the 
Nosal court. 

I. THE GOVERNMENT'S THEORY IS CONSISTENT WITH THE HOLDING OF THE 
NINTH CIRCUIT IN NOSAL. 

Nosal stands for the proposition that the term "exceeds authorized access" is limited to 
violations of restrictions on access to information, and not restrictions on its use. Nosal, 676 
F.3d at 863-64; Appellate Exhibit CXXXIX, at 9. The proper inquiry in this case, therefore, is 
whether and to what extent there was a violation of an "access restriction" to the diplomatic 
cables at issue in Specification 13 of Charge II. See Charge Sheet. The defense argument, in 
essence, is that there was no access restriction to the information because the accused was 
"authorized to access each and every piece of information he allegedly accessed." Def. Mot. at 



See http ://en. wikipedia. org/ wiki/ Wget 
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4. In the defense's view, the manner in which the information is downloaded is irrelevant. See 

id. However, the manner in which one accesses information is relevant to whether or not an 
individual "exceeds authorized access" under 18 U.S.C. § 1030(a)(1). The authority to access 
information cannot be meaningfully separated from the manner in which one does so. An 
individual's "authority" to do practically everything is limited by specific circumstances or by 
the scope of that authority, and this case is no different. See, e.g., United States v. Khamsouk, 57 
M.J. 282, 304 (C.A.A.F. 2002) (discussing that apprehension under the guise of surveillance for 
purpose of obtaining evidence exceeds the scope of an arrest warrant). To hold otherwise would 
be to ignore the plain meaning of the statutory text and this Court's ruling adopting the narrow 
meaning of "exceeds authorized access" favored by Nosal. Additionally, the practical effect of 
adopting the defense position would be to further narrow "exceeds authorized access" into 
oblivion. 

An individual "exceeds authorized access" under the CFAA and 18 U.S.C. § 1030(a)(1) 
when the individual "access[es] a computer with authorization and...use[s] such access to obtain 
or alter information in the computer that the accesser is not entitled so to obtain or alter." 18 
U.S.C. § 1030(e)(6). The renewed defense motion argues that a person exceeds authorized 
access only when he "obtains or alters information that he is not authorized to obtain or alter." 
Def. Mot. at 5. Consequently, "if a person is authorized to access certain files, the use of a 
program like Wget to download those files cannot change the fact that the person is still 
authorized to access those same files." Def. Mot. at 12. In short, the defense recycles the same 
argument they set forth in their original motion — that an accused "exceeds authorized access" to 
a computer only when he or she uses authorized access to a computer to obtain or alter 
information that he or she is never entitled to obtain or alter. See Def. Mot. at 3. This 
interpretation - that the manner of access is irrelevant - ignores common sense, the plain 
meaning of the statutory text, and the purpose of the statute itself. 

The defense argues that the Government's interpretation still relies heavily on the word 
"so" in the statutory definition of "exceeds authorized access." See Def. Mot. at 8-9. While true 
that the word "so" indicates that "the manner" matters, the Nosal court helpfully addressed this 
issue in their decision rejecting the Government's theory that the defendant in that case 
"exceeded authorized access." While discussing the Government's interpretation of the word 
"so" in the statutory definition, the court indicated that the Government's reasoning failed 
because the word "has meaning even if it doesn't refer to use restrictions." Nosal, 676 F.3d at 
858. The court explained: 

Suppose an employer keeps certain information in a separate 
database that can be viewed on a computer screen, but not copied 
or downloaded. If an employee circumvents the security measures, 
copies the information to a thumb drive and walks out of the 
building with it in his pocket, he would then have obtained access 
to information in the computer that he is not 'entitled so to obtain.' 
Or, let's say an employee is given full access to the information, 
provided he logs in with his usemame and password. In an effort 
to cover his tracks, he uses another employee's login to copy 
information from the database. Once again, this would be an 
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employee who is authorized to access the information but does so 
in a manner he was not authorized 6 so to obtain.' 

Id. 

« 

In short, even the Nosal court never went so far as to hold that the manner in which one 
accesses information is irrelevant to a determination of whether an accused "exceeds authorized 
access" within the meaning of 18 U.S.C. § 1030(a)(1) and (e)(6). The examples above, along 
with the narrow scope of the court's holding (restrictions on access to information, not 
restrictions on its use), clearly demonstrate that the court considered "the manner" relevant. The 
obvious common thread in both of the Nosal court's hypothetical is that the potential defendant 
has access to the information. The defendants were entitled or authorized to view the 
information in a specific way. The defendants only access information in excess of authority 
when they access the information in some unauthorized manner. Ultimately, if the court thought 
the issue was black and white - if an individual has access to the information in some capacity, 
then they cannot exceed authorized access - they would have articulated that draconian concept 
more clearly. While the Government concedes this jaunt is mostly dicta — it is important because 
it indicates the court's thinking on this matter. Accordingly, because the Government's theory 
has unquestioned support in the dicta of Nosal and the court's narrow holding, the Government's 
theory is a valid application of the statute. 



II. THE GOVERNMENT'S THEORY IS CONSISTENT WITH THE LANGUAGE OF 
THE 1996 LEGISLATIVE HISTORY. 

As noted by the Court in Appellate Exhibit CXXXIX, Congress amended § 1030(a)(1) in 
1996. See Appellate Exhibit CXXXIX, at 6; S. Rep. No. 104-357 (1996). The Court informed 
the parties that it would craft instructions for defining "exceeds authorized access" using the 
language in the legislative history in 1 996. Id. at 9. To the extent that the language in the 1 996 
legislative history contributes in any meaningful way to a determination of what constitutes 
"exceeding authorized access" within the meaning of § 1030(a)(1), the Government's theory of 
criminal liability is consistent with the language. 

The 1996 amendments to § 1030(a)(1) brought the language of the statute in line with 1 8 
U.S.C. § 793(e). As the Senate report explained: 

Although there is considerable overlap between 18 U.S.C. 793(e) 
and section 1030(a)(1), as amended by the Nil Protection Act, the 
two statutes would not reach exactly the same conduct. Section 
1030(a)(1) would target those persons who deliberately break into 
a computer to obtain properly classified Government secrets then 
try to peddle those secrets to others, including foreign 
governments. In other words, unlike existing espionage laws 
prohibiting the theft and peddling of government secrets to foreign 
agents, section 1030(a)(1) would require proof that the individual 
knowingly used a computer without authority, or in excess of 
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authority, for the purpose of obtaining classified information. In 
this sense then, it is the use of the computer which is being 
proscribed, not the unauthorized possession of, access to, or 
control over the classified information itself. 

S. Rep. No. 104-357, at 6 (1996). 

The defense is singularly focused on Congress' explanation that § 1030(a)(1) targets 
those persons who "deliberately break into a computer." See Def. Mot. at 10. However, the 
Government does not allege the accused hacked "into the computer to obtain information he was 
not authorized to obtain." Def. Mot. at 10. Instead, he accessed a computer with authorization 
and exceeded that authorization by circumventing procedures and using an unauthorized 
program to obtain information — he "hacked" the information. When Congress inartfully 
summarized § 1030(a)(1) in the 1996 legislative history, they were clearly referring to the 
"without authorization" prong of § 1030(a)(1). See 18 U.S.C. 1030(a)(1) ("Whoever having 
knowingly accessed a computer without authorization. ..."). There is no other logical 

explanation, because "exceeds authorized access" under 1030(e)(6) necessarily assumes that the 
individual has accessed a computer with authority in the first place — it criminalizes the "insider" 
with rights or privileges who misuses a computer. See Orin S. Kerr, Cybercrime 's Scope: 
Interpreting "Access" and "Authorization" in Computer Misuse Statutes, 78 N.Y.U. L. Rev. 
1596, 1662 (2003) [hereinafter Kerr, Cybercrime's Scope]; Nosal, 676 F.3d at 858. Thus, that 
particular phrase ("deliberately break into a computer"), is misleading if used solely as a basis 
for defining "exceeds authorized access." 

On the other hand, if "deliberately break into a computer" is merely a guiding light in 
making sense of the purpose of the statute as whole, it contributes to our understanding of 
"exceeds authorized access." As this Court recognized after considering the legislative history, 
"the statute is designed to criminalize electronic trespassers and computer hackers." In other 
words, the statute is designed to criminalize individuals who circumvent or bypass some code- 
based restriction. See generally Kerr, Cybercrime 's Scope, at 1600 (using trespassing, hacking, 
and "bypassing code-based restrictions" somewhat interchangeably). Accordingly, the 
Government's theory is entirely consistent with the legislative history and this Court's ruling. In 
order for a person to access or obtain a diplomatic cable on the NCD website, the person has to 
individually "click" or "save" the diplomatic cable after searching for the cable or navigating to 
the cable in some manner. As the evidence will show, the accused bypassed the ordinary method 
of accessing information by adding unauthorized software to his SIPRNET computer and using 
that software to rapidly harvest or data-mine the information. Wget was not available on the 
computers used by the accused or authorized as a tool to download the information. See Def. 
Mot. at 3. Thus, the accused violated a restriction on access to the information - he bypassed a 
code-based restriction - by using Wget to obtain the cables in batches. 

Additionally, the Government's theory for Specification 13 is consistent with the 
language of the legislative history because it is anchored to the accused's egregious use of 
unauthorized software on a government-owned SIPRNET computer. As Congress noted in 
discussing the difference between §§ 793(e) and 1030(a)(l ), "it is the use of the computer that is 
being proscribed, not the unauthorized possession of, access to, or control over the classified 
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information itself." Section 793(e) is focused on the unauthorized possession and transmission 
of the information, while § 1030 is focused on the misuse of a computer. Wget, despite the 
wildly erratic defense argument to the contrary, is focused on the use of the computer, not the 
use of the information." See Def. Mot. at 10 ("[T]he Government is attempting to use a violation 
of a use restriction under the AUP - the installation and use of Wget - to show that PFC 
Manning exceeded authorized access."). As such, the Government's theory is clearly consistent 
with the language of the 1996 legislative history. 

III. THE GOVERNMENT'S PROPOSED INSTRUCTIONS BALANCE COMPETING 
THEORIES AND INCORPORATE NOSAL AND THE LEGISLATIVE HISTORY. 

The Government's proposed member instructions for Specification 13 of Charge II, and 
specifically the term "exceeds authorized access," complies with this Court's ruling on the 
original Defense Motion to Dismiss Specifications 13 and 14. See Government's Proposed 
Member Instructions, at 18-22. First, the United States proposed that the Court instruct the fact 
finder that "Section 1030(a)(1) is focused on the individual's use of a computer." Id. at 19; see 
Appellate Exhibit CXXXIX, at 9 ("The Court shall craft instructions. . .using the language in the 
legislative history in 1996."). The United States incorporated language directly from the 
legislative history. Additionally, the United States proposed the following instruction for 
"exceeds authorized access": 

The term "exceeds authorized access" means to access a computer 
with authorization and to use such access to obtain or alter 
information in the computer that the accesser is not entitled so to 
obtain or alter. "Exceeds authorized access" under § 1030(a)(1) is 
limited to violations of restrictions on access to information, and 
not restrictions on its use. In deciding whether the accused 
"exceeded authorized access" to the State Department cables at 
issue, you may consider all the evidence introduced at trial, 
including any evidence concerning the use of unauthorized 
software to obtain the cables and any access limitations or 
restrictions to the State Department cables, or lack thereof, on the 
SIPRNET. The words "access" and "use" are commonly used and 
commonly understood words. 

See Government Proposed Member Instructions, at 20. 

The above instruction incorporates the statutory definition of "exceeds authorized access" 
under § 1 030(e)(6), the holding of the court in Nosal, and the competing theories of the 
Government and the defense. In other words, the instruction allows the fact finder to determine 
whether and to what extent there was an "access restriction" to the State Department cables. It 



" Arguably, the language of the 1996 legislative history — that § 1030(a)(1) would require proof that an individual 
knowingly used a computer in excess of authority for the purpose of obtaining classified information - is also fully 
compatible with the Government's previous theory that the accused "exceeded authorized access" when he violated 
a purpose-based restriction on access. 
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presents a shortened version of the Government theory (use of unauthorized software) and the 
defense theory (lack of limitations or restrictions on the SIPRNET). The instruction balances 
both theories and should be adopted by this Court in full. 



CONCLUSION 

The United States respectfully requests this Court DENY, in part, the Renewed Motion to 
Dismiss for Failure to State an Offense. For the reasons stated above, Specification 13 of Charge 
II adequately states an offense punishable under 18 U.S.C. § 1030(a)(1). In the alternative, the 
United States requests the Court defer ruling on this motion until the presentation of evidence. 
The United States maintains that its theory of criminal liability for Specification 14 is dependent 
upon instructions by the Court. 



XjpDEAN MORROW 

°CPT, JA 

Assistant Trial Counsel 



I certify that I served or caused to be served a true copy of the above on Mr. David E. 
Coombs, Civilian Defense Counsel, via electronic mail, on 6 July 2012. 




Assistant Trial Counsel 

3 Ends 

1 . Forensic Report Excerpt 

2. Article 32 Testimony, SA David Shaver 

3. Continuation Sheet, DD Form 457, pp. 27-32 
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